Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
7
7
5
3
Contributors
4
4
3
3
2
Categories
6
5
4
3
3
Platforms
11
7
1
1
1
Products / Services
7
5
5
2
1
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
IDS Classtypes
6
1
IDS Protocols
5
1
1
Detects recurring Microsoft Graph mailbox activity featuring 'command_req_' or 'command_res_' substrings within message subjects or filter queries. This pattern is indicative of attackers using email-based infrastructure for Command and Control (C2) communication, characterized by periodic polling of mailbox items.
Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).
Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).
Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).
Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).
Detects established TLS outbound connections to external networks on ports other than standard ones (e.g., 443, 465, 587, 993, 995, 8443, 9443). This behavior may indicate a covert C2 channel or unauthorized data exfiltration attempting to bypass standard firewall controls.
Detects a fake desktop.ini file combining a legitimate-looking ShellClassInfo/LocalizedResourceName lure (shell32.dll,-21781) with a C2 domain hidden as unary-encoded trailing whitespace after byte offset 174 -- consolidates the lure-content and whitespace-encoding indicators into one high-fidelity rule
AI-powered phishing-as-a-service abusing device-code authentication
AI-powered phishing-as-a-service abusing device-code authentication
This rule detects HTTP POST requests where the client body contains a large string (over 200 characters) that appears to be Base64 encoded. The `pcre` (Perl Compatible Regular Expression) `/^[A-Za-z0-9+\/]{200,}={0,2}$/` specifically looks for strings composed of Base64 characters (alphanumeric, '+', '/', and optional '==') with a minimum length of 200 characters. This pattern is often used by malware for command and control (C2) communication to obfuscate data within HTTP traffic.
This rule detects obfuscated protocol data in non-standard command and control (C2) channels over TCP. It triggers when TCP traffic flows from the home network to any destination, is established, has a data size between 101 and 499 bytes, and occurs at a high frequency (30 times in 60 seconds from the same source). This pattern is indicative of trojan activity, specifically related to command and control communications.
This rule detects the presence of percent-encoded Bi-Directional (BiDi) control characters in URLs within network events. Specifically, it looks for '%E2%80%AE' (Right-to-Left Override - RLO), '%E2%80%8E' (Left-to-Right Mark - LRM), and '%E2%80%8F' (Right-to-Left Mark - RLM). These characters can be used to obfuscate URLs, making malicious links appear benign to users and potentially bypass security controls.
Detects possible prompt injection or abuse of AI models like LLMs via unusual process and API call patterns
KQL Query from file: KQLObfusGuard - Detecting ArgFuscator Obfuscation
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, characterized by the repeated use of characters like [], (), !, and +. This rule looks for the presence of multiple distinct characters from the core JSFireTruck set within web response bodies.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, specifically looking for the combination of core JSFireTruck characters and checks for document.referrer, often used to target traffic from search engines.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, specifically looking for the combination of core JSFireTruck characters and checks for document.referrer, often used to target traffic from search engines.
Process executed from binary hidden in Base64 encoded file. Encoding malicious software is a.
Technique to obfuscate files from detection.
The first and second ProcessCommandLine component is looking for Python decoding base64.
The third ProcesssCommandLine component is looking for the Bash/sh commandline base64 decoding tool.
The fourth one is looking for Ruby decoding base64.
Technique to obfuscate files from detection.
The first and second ProcessCommandLine component is looking for Python decoding base64.
The third ProcesssCommandLine component is looking for the Bash/sh commandline base64 decoding tool.
The fourth one is looking for Ruby decoding base64.
Looks for suspicious base64 encoded registry keys being created.
Author: Jouni Mikkola
References:
https://threathunt.blog/registry-hunts/
Author: Jouni Mikkola
References:
https://threathunt.blog/registry-hunts/
This query checks for network connection failures to Microsoft Defender for Endpoint URLs.
The output includes any device with 1+ connectivity failures, a list of the domains they
failed to connect to (including the number of failures), as well as the overall number of
failures in the time period. Results are sorted by the total number of connection failures
by the device.
The output includes any device with 1+ connectivity failures, a list of the domains they
failed to connect to (including the number of failures), as well as the overall number of
failures in the time period. Results are sorted by the total number of connection failures
by the device.
Use this query to find email stealing activities ran by Qakbot that will use "ping.exe -t 127.0.0.1" to obfuscate subsequent actions.
Email theft that occurs might be exfiltrated to operators and indicates that the malware completed a large portion of its automated activity without interruption.
Email theft that occurs might be exfiltrated to operators and indicates that the malware completed a large portion of its automated activity without interruption.
Page 1 of 2